WebRAT Malware Spread via Fake Vulnerability Exploits on GitHub
The WebRAT malware is being distributed through GitHub repositories that falsely claim to host proof-of-concept exploits for recently disclosed vulnerabilities. Previously spread via pirated software and game cheats, WebRAT is a backdoor with information-stealing capabilities, including credential theft for messaging platforms and cryptocurrency wallets, webcam spying, and screenshot capture.
Source: BleepingComputer

Operation PCPcat: Hunting a Next.js Credential Stealer That’s Already Compromised 59K Servers
Researchers monitoring a Docker honeypot uncovered a large-scale attack campaign exploiting vulnerabilities in Next.js and React to achieve remote code execution, credential theft, and persistent command-and-control access. The campaign, attributed to a group identifying as “PCP,” has already compromised over 59,000 servers in less than 48 hours, demonstrating industrial-scale exploitation and data exfiltration.
Source: Beelzebub AI

APT36 LNK-Based Malware Campaign Leveraging MSI Payload Delivery
A targeted malware campaign attributed to APT36 uses social engineering and malicious shortcut files disguised as government advisory PDFs. The attack chain delivers a hidden MSI payload that deploys a .NET loader, malicious DLLs, and registry-based persistence while displaying a decoy document to evade detection and maintain long-term access.
Source: CYFIRMA

UNG0801: Tracking Threat Clusters Obsessed With AV Icon Spoofing Targeting Israel
SEQRITE Labs has been tracking a persistent threat cluster, UNG0801, primarily targeting Israeli organizations through phishing campaigns written in Hebrew. The attackers heavily rely on antivirus icon spoofing, abusing trusted security vendor branding in malicious documents to increase user trust and drive follow-on compromise.
Source: Seqrite

Operation Artemis: Analysis of HWP-Based DLL Side Loading Attacks
Researchers identified an APT37 campaign dubbed “Artemis” that embeds malicious OLE objects inside HWP documents. The multi-stage attack leverages masquerading techniques and DLL side-loading within legitimate processes to evade signature-based detection and execute malicious payloads.
Source: Genians

Two Chrome Extensions Caught Secretly Stealing Credentials from Over 170 Sites
Cybersecurity researchers have discovered two malicious Google Chrome extensions with the same name and published by the same developer that come with capabilities to intercept traffic and capture user credentials. The extensions are advertised as a “multi-location network speed test plug-in” and, once users subscribe, route traffic from more than 170 domains through attacker-controlled infrastructure, enabling large-scale data exfiltration.
Source: The Hacker News

Microsoft Teams Strengthens Messaging Security by Default in January
Microsoft announced that Teams will automatically enable messaging safety features by default starting January 12, 2026, for tenants using default configurations. The update activates protections against weaponizable file types, malicious URLs, and introduces a system for reporting false positives, improving defenses against malicious content shared in chats.
Source: BleepingComputer

Ransomware Hits Romanian Water Authority, 1000 Systems Knocked Offline
Romania’s national water authority is recovering from a ransomware attack that began on December 20, 2025, impacting approximately 1,000 systems, including workstations, email services, and web servers. Authorities classify the incident as a national security concern due to the critical infrastructure role of water management.
Source: Hackread

Critical n8n Flaw (CVSS 9.9) Enables Arbitrary Code Execution Across Thousands of Instances
A critical vulnerability tracked as CVE-2025-68613 has been disclosed in the n8n workflow automation platform. Under specific conditions, expressions supplied during workflow configuration may be evaluated in an insufficiently isolated execution context, potentially leading to arbitrary code execution.
Source: The Hacker News

Zero-Day Alert: Linksys Auth Bypass Lets Hackers Hijack Routers Without Passwords
Researchers disclosed a zero-day vulnerability (CVE-2025-52692) in the Linksys E9450-SG router that allows attackers on the local network to bypass authentication and gain full control of the device. The flaw enables activation of a hidden Telnet service without requiring a password, highlighting ongoing risks in consumer router security.
Source: Security Online

ATM Hackers Using ‘Ploutus’ Malware Charged in US
The US Department of Justice has charged 54 individuals for their involvement in a large-scale ATM jackpotting campaign using the Ploutus malware family. The suspects are linked to the Venezuelan crime syndicate Tren de Aragua and face severe penalties, including decades-long prison sentences, for bank fraud, computer hacking, and money laundering.
Source: SecurityWeek

Hackers Abuse Popular Monitoring Tool Nezha as a Stealth Trojan
Researchers discovered that the open-source monitoring tool Nezha is being repurposed as a Remote Access Trojan (RAT). Because Nezha is legitimate software widely used by administrators and shows zero antivirus detections, attackers are exploiting it to gain persistent, stealthy access to compromised systems.
Source: Hackread

MacSync macOS Malware Distributed via Signed Swift Application
Jamf reports that MacSync Stealer, a macOS information-stealing malware, is now being distributed through a signed Swift application, removing the need for terminal-based execution. The malware has evolved from the earlier Mac.c stealer and now includes full backdoor functionality via a Go-based agent.
Source: SecurityWeek

Critical RCE Flaw Impacts Over 115,000 WatchGuard Firewalls
More than 115,000 internet-exposed WatchGuard Firebox devices remain vulnerable to an actively exploited remote code execution flaw (CVE-2025-14733). Successful exploitation allows unauthenticated attackers to execute arbitrary code, particularly on devices configured with IKEv2 VPN services.
Source: BleepingComputer

ClickFix Used to Deploy Stealc and Qilin Ransomware
Sophos researchers detail how the ClickFix social-engineering technique is being used to deploy Stealc infostealers and facilitate Qilin ransomware attacks. Victims are tricked into following fake human-verification steps on compromised websites, leading to malware installation and later ransomware deployment.
Source: Sophos

China-Aligned Threat Group Uses Windows Group Policy to Deploy Espionage Malware
A previously undocumented China-aligned threat cluster dubbed LongNosedGoblin has been linked to cyber espionage attacks noted in Southeast Asia and Japan. According to ESET, the group leverages Windows Group Policy to deploy malware across compromised networks and abuses cloud services such as Microsoft OneDrive and Google Drive for command-and-control operations.
Source: The Hacker News

Coordinated Credential-Based Campaign Targets Cisco and Palo Alto Networks VPN Gateways
GreyNoise is tracking a coordinated, automated credential-based campaign targeting enterprise VPN authentication infrastructure, including Cisco SSL VPN and Palo Alto Networks GlobalProtect. The activity consists of large-scale scripted login attempts rather than vulnerability exploitation and appears to be a single campaign pivoting across multiple VPN platforms.
Source: GreyNoise

Lazarus Group Embed New BeaverTail Variant in Developer Tools
Darktrace research has identified a new variant of the JavaScript-based BeaverTail infostealer linked to North Korea’s Lazarus Group. The malware is distributed through fake job offers that lure developers into downloading tools supposedly required for technical interviews, which instead compromise victim systems.
Source: Hackread

Clop Ransomware Targets Gladinet CentreStack in Data Theft Attacks
The Clop ransomware gang is targeting internet-exposed Gladinet CentreStack file servers as part of a new data theft extortion campaign. Attackers are actively scanning for exposed servers, breaching them, and leaving ransom notes, despite previous security updates released by Gladinet to address exploited vulnerabilities.
Source: BleepingComputer

Rust’s First Breach: CVE-2025-68260 Marks the First Rust Vulnerability in the Linux Kernel
A vulnerability tracked as CVE-2025-68260 has been fixed in the Linux kernel, marking the first officially assigned CVE for Rust code in the mainline kernel. The issue affects the Rust-based Android Binder driver and could lead to system crashes due to unsafe concurrent manipulation of linked list elements.
Source: Security Online

New Wave of VPN Login Attempts Targets Palo Alto GlobalProtect Portals
A large campaign began on December 2, targeting Palo Alto GlobalProtect portals with brute-force attempts and later scanning SonicWall SonicOS API endpoints. The activity originated from over 7,000 IPs tied to hosting provider 3xK GmbH (AS200373), according to GreyNoise.
Source: BleepingComputer

AI-Automated Threat Hunting Brings GhostPenguin Out of the Shadows
Trend Micro uncovered GhostPenguin, a multithreaded Linux backdoor using RC5-encrypted UDP communications, discovered via AI-driven automated threat hunting. The backdoor supports remote shell access, file operations, and resilient command delivery through synchronized threads.
Source: Trend Micro

China-Linked Warp Panda Targets North American Firms in Espionage Campaign
CrowdStrike reports that Warp Panda is conducting advanced cyber espionage against North American legal, tech and manufacturing firms. The actor demonstrates strong OPSEC and cloud/VM expertise, with observed targeting of VMware vCenter environments in 2025.
Source: Infosecurity Magazine

Over 70 Domains Used in Months-Long Phishing Spree Against US Universities
Infoblox uncovered a months-long phishing operation targeting at least 18 U.S. universities. Attackers used more than 70 domains and bypassed MFA using the Evilginx adversary-in-the-middle toolkit to steal login credentials.
Source: Hackread

Inside Shanya, a Packer-As-A-Service Fueling Modern Attacks
Sophos analyzed Shanya, a new packer-as-a-service tool now favored by ransomware groups, partially replacing HeartCrypt. Shanya supports complex obfuscation and has been used in targeted attacks observed during incident response operations.
Source: Sophos

‘Broadside’ Mirai Variant Targets Maritime Logistics Sector
Cydome researchers identified “Broadside,” a Mirai variant exploiting CVE-2024-3721 in maritime digital recording devices. The flaw enables remote command injection and persistent monitoring via Netlink, threatening global logistics operations.
Source: Dark Reading

Researchers Uncover 30+ Flaws in AI Coding Tools Enabling Data Theft and RCE
Security researcher Ari Marzouk disclosed 30+ vulnerabilities in AI-powered IDEs like Cursor, Windsurf, GitHub Copilot, Roo Code, Zed.dev and others. The flaws, dubbed “IDEsaster,” combine prompt injection with legitimate features to enable data exfiltration and remote code execution.
Source: The Hacker News

Marquis Software Breach Affects Over 780,000 Nationwide
Marquis Software confirmed a breach affecting more than 780,000 individuals after attackers exploited a SonicWall vulnerability to access and exfiltrate sensitive files from its systems. The impacted data included financial and personal information from client institutions.
Source: Infosecurity Magazine

LockBit 5.0 Infrastructure Exposed in New Server, IP, and Domain Leak
Researchers identified LockBit 5.0 infrastructure hosted on 205.185.116.233 and the domain karma0.xyz, both tied to PONYNET. The exposure reveals operational details amid LockBit’s resurgence with upgraded malware capabilities.
Source: Cybersecurity News

AWS: China-Linked Threat Actors Weaponized React2Shell Hours After Disclosure
AWS warns that China-linked threat actors began exploiting the newly disclosed React2Shell vulnerability (CVE-2025-55182) within hours. Although AWS services are unaffected, the flaw impacts organizations running vulnerable React/Next.js deployments.
Source: Security Affairs

Large-Scale ClickFix Phishing Attacks Target Hotel Systems with PureRAT Malware
Cybersecurity researchers uncovered a large-scale phishing campaign aimed at the hospitality sector, using ClickFix-style pages to trick hotel managers into deploying PureRAT malware. Attackers leveraged compromised email accounts to impersonate Booking.com and redirect victims to credential-stealing sites. The stolen credentials grant unauthorized access to booking platforms like Booking.com and Expedia, which are then monetized or used for further fraud.
Source: TheHackerNews

Microsoft Uncovers ‘Whisper Leak’ Attack That Identifies AI Chat Topics in Encrypted Traffic
Microsoft researchers discovered a side-channel attack named Whisper Leak, capable of revealing AI chat conversation topics from encrypted traffic. The attack targets streaming-mode language models, allowing adversaries monitoring network traffic—such as nation-state actors or local network observers—to infer user prompt subjects. The discovery raises significant concerns about the privacy of enterprise and user communications with AI systems.
Source: TheHackerNews

QNAP Patches Vulnerabilities Exploited at Pwn2Own Ireland
QNAP Systems released security updates for two dozen vulnerabilities, seven of which were exploited during the Pwn2Own Ireland 2025 hacking competition. Researchers from Team DDOS and DEVCORE demonstrated chained exploits affecting QNAP routers and NAS devices, earning over $140,000 in rewards. The company urges all users to update to HBS 3 Hybrid Backup Sync version 26.2.0.938 and reset passwords after patching.
Source: SecurityWeek

‘Ransomvibing’ Infests Visual Studio Extension Market
A new malicious extension on Visual Studio Marketplace introduces “ransomvibing” — ransomware code generated through AI “vibe coding.” The extension openly encrypts and exfiltrates data, marking a disturbing trend of threat actors leveraging AI tools to create malware via natural language prompts. Researchers warn that as AI-generated code becomes common in development environments, its misuse by cybercriminals will likely increase.
Source: DarkReading

GlassWorm Malware Returns on OpenVSX With 3 New VSCode Extensions
The GlassWorm malware campaign resurfaced on OpenVSX with three new VSCode extensions downloaded over 10,000 times. The malware uses hidden Unicode characters and Solana blockchain transactions to steal credentials and crypto wallet data. In response, OpenVSX revoked access tokens for compromised accounts and implemented stronger security controls to prevent further incidents.
Source: BleepingComputer

Crossed Wires: A Case Study of Iranian Espionage and Attribution
Proofpoint researchers analyzed an espionage campaign originating from Iran that began with a benign email discussing domestic unrest. The campaign’s tactics overlapped with several Iranian-linked groups, including TA455, TA453, and TA450. Due to the lack of a definitive connection to any specific group, Proofpoint designated the activity as a new temporary cluster, UNK_SmudgedSerpent. The case highlights the complexity of attribution among state-aligned threat actors.
Source: Proofpoint

Industry Attacks Surge, Mobile Malware Spreads: The ThreatLabz 2025 Mobile, IoT & OT Report
Zscaler’s ThreatLabz 2025 report reveals a surge in attacks across mobile, IoT, and OT environments, reflecting their growing interconnection in business infrastructure. Android malware activity increased by 67% year-over-year, with 239 malicious apps downloaded over 42 million times. The Energy, Transportation, and Healthcare sectors saw attack spikes of 387%, 382%, and 224% respectively, driven by advanced spyware and trojans.
Source: Zscaler

LANDFALL: New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices
Palo Alto Networks’ Unit 42 uncovered a new Android spyware family named LANDFALL, exploiting zero-day CVE-2025-21042 in Samsung’s image processing library. The spyware was delivered through malicious DNG image files sent via WhatsApp and was actively exploited in the wild before Samsung issued a patch in April 2025. The attack chain resembles previous Apple and WhatsApp exploits, indicating a broader pattern in cross-platform spyware distribution.
Source: Unit 42 (Palo Alto Networks)

November 2025 Patch Tuesday Forecast: Windows Exchange Server EOL?
HelpNetSecurity’s Patch Tuesday forecast highlights Microsoft’s record number of fixes for October 2025, addressing 250 CVEs across Windows 10 and 11. With end-of-life support ending for several enterprise editions and older Office and Exchange Server versions, Microsoft urges organizations to migrate to supported platforms. The final update for Windows 11 23H2 Professional arrives next week, while Education and Enterprise editions will be supported until November 2026.
Source: HelpNetSecurity

Tracking a Dragon: Investigating a DragonForce-affiliated Ransomware Attack with Darktrace
Darktrace investigated a ransomware attack linked to DragonForce affiliates targeting the manufacturing sector. The attackers used credential brute-forcing, data exfiltration, and file encryption. Analysis of Windows Registry artifacts revealed manipulation of scheduled tasks and WMI security settings, indicating persistence techniques. The findings demonstrate the sophistication of DragonForce-linked ransomware operations.
Source: Darktrace

ClickFix Malware Attacks Evolve With Multi-OS Support, Video Tutorials
The ClickFix malware campaign has advanced with new features including multi-OS support, embedded video tutorials guiding victims through infection, and system auto-detection for tailored payload execution. Previously, attackers relied on written instructions to trick users into executing malicious code, but now they use convincing videos to enhance credibility. The goal remains to deploy information stealers and other malware through deceptive social-engineering tactics.
Source: BleepingComputer

Critical Cisco UCCX Flaw Lets Attackers Run Commands as Root
Cisco patched a critical flaw (CVE-2025-20354) in its Unified Contact Center Express (UCCX) platform that could allow unauthenticated attackers to execute commands with root privileges. The vulnerability, located in the Java RMI process, was reported by security researcher Jahmel Harris. Cisco also addressed a separate flaw in its CCX Editor application that could allow attackers to bypass authentication and execute arbitrary scripts remotely with administrative rights.
Source: BleepingComputer

SonicWall Confirms State-Sponsored Hackers Behind September Cloud Backup Breach
SonicWall confirmed that state-sponsored actors were responsible for the September breach that exposed firewall configuration backup files. The attackers accessed the backups via an API call from a specific cloud environment. While the company emphasized that the incident was unrelated to Akira ransomware attacks, it did not name the nation behind the activity. The breach affected less than 5% of SonicWall customers using the cloud backup service.
Source: TheHackerNews

From Tabletop to Turnkey: Building Cyber Resilience in Financial Services
The financial sector is now required to conduct cyber resilience exercises due to global regulatory mandates such as DORA in the EU and CPS230 in Australia. These tabletop exercises, once optional, have become an operational necessity. The complexity of compliance lies in cross-functional collaboration, combining technical and non-technical teams to meet resilience standards and strengthen organizational preparedness.
Source: TheHackerNews

Nevada Ransomware Attack Started Months Before It Was Discovered, Per Report
An after-action report revealed that Nevada’s August ransomware attack began as early as May 2025, when a state employee unknowingly downloaded malicious software. The incident disrupted critical services including licensing, employment checks, and payroll operations. Recovery efforts cost the state at least $1.5 million, though officials confirmed no ransom was paid. The attack underscores the growing threat of ransomware to state-level infrastructure.
Source: SecurityWeek

Beating XLoader at Speed: Generative AI as a Force Multiplier for Reverse Engineering
Check Point Research highlights how generative AI is revolutionizing malware analysis, enabling researchers to rapidly decode and understand complex malware like XLoader. Traditionally, XLoader’s multiple encryption layers, obfuscation, and fake C2 domains made it one of the hardest malware families to reverse-engineer. With generative AI, analysts can now identify algorithms, generate decryption tools, and uncover indicators of compromise in hours rather than days, significantly improving response speed.
Source: Check Point Research

Exploiting Microsoft Teams: Impersonation and Spoofing Vulnerabilities Exposed
New research from Check Point reveals that Microsoft Teams contained vulnerabilities allowing attackers to impersonate executives, manipulate messages, and spoof notifications. The flaws could be exploited by malicious insiders or external guest users, fundamentally compromising trust in corporate communications. Attackers could appear as high-level executives or alter message histories without detection, exposing major risks for organizations that rely heavily on Teams for collaboration and decision-making.
Source: Check Point Research

GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools
Google’s Threat Intelligence Group (GTIG) reports that adversaries have moved beyond using AI for efficiency — they are now deploying AI-enabled malware capable of adapting in real time. The “AI Threat Tracker” update shows both state-backed and cybercriminal groups integrating machine learning into attacks, enhancing evasion and persistence. The findings reflect an operational shift toward dynamic, self-modifying AI-driven threats across the attack lifecycle.
Source: Google Cloud

Software Supply Chain Attacks Surge to Record High in October 2025
According to Cyble, software supply chain attacks reached record levels in October 2025 — up 30% from the previous peak in April. Threat actors claimed 41 attacks during the month, doubling the average monthly activity from early 2024. The surge is linked to zero-day exploits and increased targeting of SaaS and IT service providers. Cyble warns that elevated activity levels indicate sustained long-term risk, with AI-powered phishing and cloud threats further fueling the trend.
Source: Cyble

South Africa Launches Pilot for Secure Data Exchange Among Government Agencies
South Africa has launched “MzansiXchange,” a pilot initiative enabling secure data exchange between government departments. Led by the National Treasury, the system aims to eliminate data silos and improve public-sector efficiency by allowing real-time collaboration and informed decision-making. Rather than centralizing information, MzansiXchange acts as a secure bridge between authorized entities, promoting interoperability and transparency in governance.
Source: Cyble

Preparing for Threats to Come: Cybersecurity Forecast 2026
Google Cloud released its Cybersecurity Forecast 2026 report, providing insight into key security challenges expected in the coming year. The report highlights a major shift as adversaries fully embrace AI to accelerate and scale their operations. Another focus area is the rise of prompt injection attacks — manipulations of AI models to execute hidden malicious commands. The forecasts are based on real-world data and frontline intelligence from Google Cloud experts, analysts, and researchers.
Source: Google Cloud

U.S. Prosecutors Indict Cybersecurity Insiders Accused of BlackCat Ransomware Attacks
Federal prosecutors have charged three U.S. nationals — Ryan Clifford Goldberg, Kevin Tyler Martin, and an unnamed co-conspirator — for deploying BlackCat ransomware against five U.S. companies between May and November 2023. The defendants, who worked as incident response and ransomware negotiators, allegedly abused their positions to conduct extortion attacks targeting companies in healthcare, pharmaceuticals, and engineering. They are accused of stealing and encrypting data, demanding cryptocurrency ransoms, and publishing stolen information online.
Source: TheHackerNews

Hackers Exploit Critical Auth Bypass Flaw in JobMonster WordPress Theme
Threat actors are actively exploiting CVE-2025-5397, a critical authentication bypass flaw in the JobMonster WordPress theme, to hijack administrator accounts. The flaw, with a CVSS score of 9.8, stems from improper identity verification in the check_login() function. Wordfence detected multiple exploit attempts across client websites. JobMonster, a popular job board theme used by recruitment platforms, remains vulnerable in all versions up to 4.8.1.
Source: BleepingComputer

Fake Solidity VSCode Extension on Open VSX Backdoors Developers
A fake Solidity VSCode extension named “juan-bianco.solidity-vlang” uploaded to the Open VSX registry has been found distributing a remote access trojan dubbed SleepyDuck. Initially harmless, the extension gained malicious capabilities after an update and has since been downloaded more than 53,000 times. The malware uses an Ethereum smart contract as a covert command channel, allowing attackers to control infected developer systems.
Source: BleepingComputer

Apple Patches 19 WebKit Vulnerabilities
Apple released iOS 26.1 and macOS updates addressing over 100 security flaws, including 19 affecting the WebKit engine. Successful exploitation could allow attackers to steal cross-origin data, cause crashes, or monitor user keystrokes. Notably, many of these vulnerabilities were identified by Google’s “Big Sleep” AI agent, which autonomously finds exploitable bugs before threat actors can weaponize them.
Source: SecurityWeek